Cyber insurance is essential for businesses today, but acquiring the appropriate coverage is a challenge, writes The New York Times. Citing Target's infamous breach of its point-of-sale systems late last year, The Times says lack of data on cyber breaches and the inability to quantify losses from attacks make it difficult for insurers to underwrite the coverage.

The Times reports the most coverage a company can acquire using multiple underwriters is approximately $300 million—significantly less than the billions of dollars' worth of coverage available in property insurance. At the time of its breach, Target had $100 million in cyber coverage, on top of a $10 million deductible, according to regulatory filings. The Times reports the coverage, which came from multiple carriers, will barely compensate for the $1 billion in losses some analysts are forecasting. Since the breach was discovered, the company has incurred $88 million in breach-related expenses, its filings say, and it expects insurance to cover $52 million of that.

Part of the problem with underwriting cyber coverage is that losses from a breach are often intangible, such as lost sales or damage to a brand name, like Target's public relations disaster after the breach. The Times also notes underwriters lack the data they need to figure out how likely it is that an attack will occur and what it will cost, because most breaches go unnoticed or are never publicly reported. At the same time, cyber criminals are always getting more advanced, making information on past attacks not particularly helpful.